Newspaper

Remote management runs through a WebSocket channel. Both ends derive identical CA, server and client certificates from a shared password, using BouncyCastle with the secp256r1 curve and SHA-256, so no certificate has to be exchanged by hand. The TLS handshake performs mutual authentication, and application-layer authentication messages are only needed after it. Connections use wss, and data frames must be binary with opcode 0x2.

The mod can also run system shell commands remotely with a configurable timeout, move files as Base64 over the same channel, and connect outward from servers that sit behind NAT or a firewall through a reverse proxy mode. Optional PROXY Protocol v1 and v2 support lets it read client IP addresses behind a reverse proxy. Its audit log is tamper-proof through continuous file locking.

Newspaper requires mTLS, and the password must be configured. Passwords are either auto-generated as 128-bit keys, which are validated against rules for uppercase letters, lowercase letters and digits, or set by the owner. Invalid config values reset to defaults with a WARN log entry. The mod is published for Fabric and, from the same shared codebase, for Paper 1.21.1 – 26.2. The latest Fabric build is 2.1.0 for 26.2, a beta release. The code is open source under the MIT License.